For full changes, refer http://dev.mysql.com/doc/refman/5.0/en/news-5-0-91.html.
Here is security related changes.
* Security Fix: The server failed to check the table name argument of
a COM_FIELD_LIST command packet for validity and compliance to
acceptable table name standards. This could be exploited to bypass
almost all forms of checks for privileges and table-level grants by
providing a specially crafted table name argument to COM_FIELD_LIST.
In MySQL 5.0 and above, this allowed an authenticated user with
SELECT privileges on one table to obtain the field definitions of
any table in all other databases and potentially of other MySQL
instances accessible from the server's file system.
Additionally, for MySQL version 5.1 and above, an authenticated user
with DELETE or SELECT privileges on one table could delete or read
content from any other table in all databases on this server, and
potentially of other MySQL instances accessible from the server's
file system. (Bug#53371, CVE-2010-1848)
* Security Fix: The server was susceptible to a buffer-overflow attack
due to a failure to perform bounds checking on the table name
argument of a COM_FIELD_LIST command packet. By sending long data
for the table name, a buffer is overflown, which could be exploited
by an authenticated user to inject malicious code. (Bug#53237,
CVE-2010-1850)
* Security Fix: The server could be tricked into reading packets
indefinitely if it received a packet larger than the maximum size of
one packet. (Bug#50974, CVE-2010-1849)
This changes the buildlink3.mk files to use an include guard for the
recursive include. The use of BUILDLINK_DEPTH, BUILDLINK_DEPENDS,
BUILDLINK_PACKAGES and BUILDLINK_ORDER is handled by a single new
variable BUILDLINK_TREE. Each buildlink3.mk file adds a pair of
enter/exit marker, which can be used to reconstruct the tree and
to determine first level includes. Avoiding := for large variables
(BUILDLINK_ORDER) speeds up parse time as += has linear complexity.
The include guard reduces system time by avoiding reading files over and
over again. For complex packages this reduces both %user and %sys time to
half of the former time.
For complete changes, please refer
http://dev.mysql.com/doc/refman/5.0/en/releasenotes-cs-5-0-67.html.
Here is a part of it.
Functionality added or changed:
Security Enhancement:
To enable stricter control over the location from which user-defined
functions can be loaded, the plugin_dir system variable has been
backported from MySQL 5.1. If the value is non-empty, user-defined
function object files can be loaded only from the directory named by this
variable. If the value is empty, the behavior that is used before 5.0.67
applies: The UDF object files must be located in a directory that is
searched by your system's dynamic linker. (Bug#37428)
Important Change: Incompatible Change:
The FEDERATED storage engine is now disabled by default in the .cnf files
shipped with MySQL distributions (my-huge.cnf, my-medium.cnf, and so
forth). This affects server behavior only if you install one of these
files. (Bug#37069)
Cluster API: Important Change:
Because NDB_LE_MemoryUsage.page_size_kb shows memory page sizes in bytes
rather than kilobytes, it has been renamed to page_size_bytes. The name
page_size_kb is now deprecated and thus subject to removal in a future
release, although it currently remains supported for reasons of backward
compatibility. See The Ndb_logevent_type Type, for more information about
NDB_LE_MemoryUsage. (Bug#30271)
Important Change:
Some changes were made to CHECK TABLE ... FOR UPGRADE and REPAIR TABLE
with respect to detection and handling of tables with incompatible .frm
files (files created with a different version of the MySQL server). These
changes also affect mysqlcheck because that program uses CHECK TABLE and
REPAIR table, and thus also mysql_upgrade because that program invokes
mysqlcheck.
This is a bugfix release for the current production release family.
MySQL 5.0.26 introduced an ABI incompatibility, which this release
reverts. Programs compiled against 5.0.26 are not compatible with
any other version and must be recompiled.
and add a new helper target and script, "show-buildlink3", that outputs
a listing of the buildlink3.mk files included as well as the depth at
which they are included.
For example, "make show-buildlink3" in fonts/Xft2 displays:
zlib
fontconfig
iconv
zlib
freetype2
expat
freetype2
Xrender
renderproto
RECOMMENDED is removed. It becomes ABI_DEPENDS.
BUILDLINK_RECOMMENDED.foo becomes BUILDLINK_ABI_DEPENDS.foo.
BUILDLINK_DEPENDS.foo becomes BUILDLINK_API_DEPENDS.foo.
BUILDLINK_DEPENDS does not change.
IGNORE_RECOMMENDED (which defaulted to "no") becomes USE_ABI_DEPENDS
which defaults to "yes".
Added to obsolete.mk checking for IGNORE_RECOMMENDED.
I did not manually go through and fix any aesthetic tab/spacing issues.
I have tested the above patch on DragonFly building and packaging
subversion and pkglint and their many dependencies.
I have also tested USE_ABI_DEPENDS=no on my NetBSD workstation (where I
have used IGNORE_RECOMMENDED for a long time). I have been an active user
of IGNORE_RECOMMENDED since it was available.
As suggested, I removed the documentation sentences suggesting bumping for
"security" issues.
As discussed on tech-pkg.
I will commit to revbump, pkglint, pkg_install, createbuildlink separately.
Note that if you use wip, it will fail! I will commit to pkgsrc-wip
later (within day).
MySQL is a SQL (Structured Query Language) database server. SQL is the
most popular database language in the world. MySQL is a client-server
implementation that consists of a server daemon `mysqld' and many
different client programs/libraries.
The main goals of MySQL are speed and robustness.
The base upon which MySQL is built is a set of routines that have been
used in a highly demanding production environment for many years. While
MySQL is still in development it already offers a rich and highly useful
function set.
The official way to pronounce 'MySQL' is 'My Ess Que Ell' (Not MY-SEQUEL).
This package contains the MySQL client programs and libraries.
